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(U) ATTACK ON FIBER OPTIC LINES IN SAN JOSE I 
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[U//FOUO) 


[Unknown 
parties shot at and damaged a 
transformer at the Metcalf Road Pacific 
Gas and Electric USPER (PG&E) 
subsidt i un, men ibeii hdiitf tou t s to - 

sever nearby fiber optic cables, 
disrupting local communications, 
including 911 services. 


Figure 1 - (U) Damaged transformer 
at Metcalf Substation 

Source: San Francisco Chronicle 


(U//FOUO)| 


|The substation and cables are located 


(U) Source Summary and Confidence Level Statements 

(U) We have high confidence in our judgments based on the nature of our sources, which 
were predominantly from reliable media outlets, telecommunications vendors, and official 
law enforcement reporting. Full information was not available on either incident due to the 
San lose case being the subject of an ongoing investigation, and the lack of available 
first-hand reporting regarding the Egyptian case. However, our judgments are based on 
the basic nature of each attack, and we do not believe additional information would 
significantly alter our conclusions. 
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approximately one mile from the nearest residential neighborhood in a rural area located off 



• (U//LES) On 18 April 2013, unknown actors breached a fence at the PG&E electrical 
substation located near Metcalf Road in San Jose. According to a Northern California 
Regional Intelligence Center (NCRIC) notification, the attackers breached the fence at 
the facility, and then used a rifle to shoot at and damage five transformers 
(see Figure l). 2 Immediately prior to the attack, telecommunications personnel noticed a 
disruption in the Santa Clara County 911 system, which also disrupted AT&T USPER phone 
communications in the 



Figure 2 - Map location of PG&E substation damaged on 18 April 2013. 

Source: Google 
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(U//FOUO) 



(U) An Incident similar to the one in April 2013 occurred in April 2009 when unknown persons cut 
ten Verlzon USPER underground cables at four locations in south San Jose, The outage affected 
emergency response networks, internet connections, phone services, and ATMs in Santa Clara, 
San Benito and Santa Cruz counties. 



(U) ATTEMPT TO SABOTAGE UNDERSEA FIBER-OPTIC CABLE IN EGYPT 



• (U) On 27 March 2013, the Egyptian navy captured three as-yet unidentified men who 

were cutting the SMW-4 underwater fiber-optic cable at a cable landing in Alexandria. 5 
According to pictures provided by naval officials, the men were equipped with SCUBA 
equipment and possibly hand tools for cutting the cable's insulation. The SMW-4 cable 
connects Internet users In Europe, Africa, and Asia, stretching from France to Malaysia 
through the Mediterranean, the Arabian Sea, and the Indian Ocean. 0 The damaged cable 
caused a drop in Internet speed in Egypt. 7 A map of the affected cable Is below. 



(U) Dry Plant 

' (U) According to. DHS, a dry 
plant Is a building co-located 
, at a cable landing Site 
. containing electrical, 
switching, signal 
amplification, and routing 
— e qui p m e nt . Dry p l ants oervo 

as a transfer point for 
Intercontinental and 
domestic communications 
networks. 



3 


a (U) Cable landing stations contain operations equipment for powering up underwater repeaters and 
amplifiers. Cable termination stations, in contrast, are where cables physically connect to land-based 
networks. 
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Figure 3 - (U) Map showing cable landing points in California. 

(U) There are 12 cable landing points in California with some sites co-located at the same facility. 
Note: The Monterey Bay Aquarium Research Institute USPER cable is not on this map, as it is a non¬ 
commercial scientific cable. 9 
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(U) Inset: Cable entry sites and dry plant at Pont Arena Cable Station near Manchester, CA. Entry to 
the dry plant is restricted; however access to the beach is not. Dry plant access control measures 
include fencing, card readers, and security cameras. 10 

(U) Sources: TeleGeography and Telephone Central Offices 
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(U) ADMINISTRATIVE NOTE 

(U) For comments or questions related to the content or dissemination of this document, 
please contact the STAC at (916) 874-1100 or STAC@calema.ca.Qov . 

(U)TRACKED BY 

(U) HSEC-1.6.2.4, HSEC-7.6.2.4 

(U)FEEDBACK 

(U) The STAC encourages your feedback using the survey found at 
https://www.survevmonkey.eom/s/VG5GZ2N 

(U) ENDNOTES 


1 (U) Website; Vivek Alwayn; "Fiber-Optic Technologies"; posted 23 April 2004; 

http://www.ciscopress.com/articles/article.asD?p=1707408tseaNum=4 : accessed on 30 May 
2013. Cisco is a U.S.-based telecommunications provider that designs, manufactures, and 
sells networking equipment. 

2 (U) Online Newspaper Article; No Author Listed; CBS News; "Vandalism At San Jose PG8tE 
Substation Called 'Sabotage'"; 16 April 2013; 

http://sanfrancisco.cbslocal.com/2013/04/l6/gunshots-cause-oil-spill-at-san-jose-pge- 
substation/; accessed on 23 April 2013. 
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4 (U) Online Newspaper Article; Nanette Asimov, Ryan Kim, and Kevin Fagan; San Francisco 
Chronicle; "Sabotage Attacks Knock Out Phone Service"; 10 April 2009; 
http://www.sfgate.com/bayarea/article/Sabotage-attacks-knock-out-phone-service- 
3245380.php; accessed on 22 May 2013. 

0 (U) Online Newspaper Article; No Author Listed: Associated Press : "Egypt: Naval Forres 

Capture Three Divers Trying to Cut Undersea Internet Cable"; 27 March 2013; 
http://www.washingtonpost.com/world/middle_east/egypt-naval-forces-capture-3-scuba- 
divers-trying-to-sabotage-undersea-internet-cable/2013/03/27/dd2975ec-9725-lle2-a976- 
7eb906f9ed9b_story.html; accessed on 28 March 2013. 

6 (U) Internet Site; Telegeography; "Submarine Cable Map"; 26 March 2013; 
http:/Avww.submarinecablemap.com/ : accessed on 28 March 2013. 

7 (U) Online Newspaper Article; No Author Listed; BBC; "Egypt Arrests as Undersea Internet 
Cable Cut Off Alexandria"; 27 March 2013; http://www.bbc.co.uk/news/world-middle-east- 
21963100; accessed on 18 April 2013. 




9 (U) Website; TeleGeography; "2012 Submarine Cable Map"; 30 May 2013; 
http://www.submarinecablemap.com/ : accessed on 30 May 2013. TeleGeography is a U.S- 
based telecommunications market research and consulting firm. 
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10 (U) Website; Telephone Central Offices; "Point Arena Cable Station"; posting date 
unknown; http://www.thecentraloffice.com/Microwave/NMW/PARNCA/PARNCA01.htm ; 
accessed on 25 April 2013. Telephone Central Offices is a website operated by 
telecommunications equipment enthusiasts. 
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• (U//FOUO) SnowCrest U5PER , an Internet provider in Siskiyou 
County, stated on their Facebook USPER page that their Internet 
and phone services were down on 7 July due to 3 fiber optic 
cables being cut "elsewhere in California". 1 The company's 
fiber backbone is CenturyLink, and this outage may be related 
the San Jose incident. Snowcrest also experienced an outage 
on 13 February due to a cut in a fiber-optic line between 
Sacramento and Yuba City. 2 


(U//FOUO) There have been at least three similar incidents in 




Figure 4 - (U) Collapsed public safety 
communications tower near San Ramon, CA 
(SOURCE: KTVU USPER ) 



Figure 4 - (U) Repair of severed fiber optic lines 
in Del Mar, CA (SOURCE: NBC News) 









(U) On 14 June 2012, unidentified subjects cut two AT&T U5PER 
underground fiber optic cables in Del Mar, CA. The attack led 
to an Internet cable television and landline phone service 
disruption across San Diego County. According to AT&T, the 
perpetrators had knowledge of the system and intended to 
disrupt service rather than steal equipment. 5 



Figure 4 - (U) Public safety communication sites 
in San Francisco, CA affected in July 2012 
incident (SOURCE: Google USPER Maps) 
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® (U) On 9 April 2009, unknown parties severed ten fiber-optic communication lines in four 

underground vaults across San Jose, CA, disabling landline, cellular, and Internet service across Santa 
Clara, Santa Cruz, and San Benito Counties. Four lines in south San Jose were first cut, followed by 
two more at a location two miles away. Approximately two hours later, attackers cut four additional 
cables located in two locations in San Carlos. 6 According to local taw enforcement officials, a special 
tool was required to open each vault, none of which were readily visible from the street. 7 



(U//LES) On 16 April 2013, unknown actors damaged or destroyed multiple transformers at the 
Pacific Gas and Electric USPER electrical substation located near Metcalf Road in San Jose. According to 
a NCRIC notification, immediately prior to the attack, telecommunications personnel noticed a 
disruption i n the Santa Clara County 911 system, which also disrupted AT&T phone communicat ions 
in the area.r 
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(U) ADMINISTRATIVE NOTE 

(U) For comments or questions related to the content or dissemination of this document, please contact 
the STAC at (916) 874-1100 or STAC@caloes.ca.eov . 

(U)TRACKED BY 

(U) HSEC-1.6.2.5 

(U)FEEDBACK 

(U) The STAC encourages your feedback using the survey found at 
https://www.survevmonkey.eom/s/XXXXXX . 

(U) ENDNOTES 


1 (U) Website; "SnowCrest Inc. - Mount Shasta, CA- Internet/Software | Facebook"; 7 July 2014; 
https://www.facebook.com/pages/SnowCrest-lnc/178644392218862: accessed on 8 July 2014. 


2 (U) Online Newspaper Article; No Author Listed; Redding Record Searchlight; "UPDATED: Snowcrest says Internet 
service is back"; 7 July 2014; http://www.reddina.com/news/local-news/cut-cables-interrupt-internet-provider- 
snowcrests-services: accessed on 8 July 2014. 



5 (U) Online Newspaper Article; Tony Shin and Monica Garske; NBC News; "AT&T Cables Vandalized, $250,000 
Reward Offered for Information"; 15 June 2012; http://www.nbcsandieao.com/news/local/ATT-Cables-Cut- 
Vandalized-25QOOO-Reward-Offered-159155295.html : accessed on 18 December 2013. 


°(U) Online Newspaper Article; Nanette Asimov, Ryan Kim and Kevin Fagan; San Francisco Chronicle, "Sabotage 

attacks knock out phone service"; 10 April 2009; http://articles.sfeate.com/2009-Q4-10/news/17191717 1 cables- 
debit-cards-vandals: accessed on 5 December 2011. 

7 (U) Online Newspaper Article; Lori Preuitt; NBC News; "$250K Reward Out for Vandals Who Cut AT&T Lines"; 10 
April 2009; http://www.nbcbavarea.com/news/local/South-Bav-Dead-2one.html: accessed on 5 December 2011. 

8 (U) Online Newspaper Article; No Author Listed; CBS News; "Vandalism At San Jose PG&E Substation Called 
'Sabotage'"; 16 April 2013; http://sanfrandsco.cbslocal.com/2013/04/16/gunshots-cause-oil-spill-at-san-iose-pee- 
substation ; accessed on 14 July 2014. 



10 (U) Online Newspaper Article; Nanette Asimov, Ryan Kim, and Kevin Fagan; Son Francisco Chronicle; "Sabotage 
Attacks Knock Out Phone Service"; 10 April 2009; http://www.sfgate.com/bavarea/article/Sabotaae-attacks-knock- 
out-phone-service-3245380.php; accessed on 14 July 2014. 


UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE 


PRA_MuckR«fck 000011 





















Ducker, Tom@CalOES 


From: 

Sent: 

To: 

Cc: 

Subject: 


Nezhura, Lori@CalOES 
Monday, July 11,2016 9:17 AM 
Ducker, Tom@CalOES; Wilson, Dena@CalOES 

Owen, Eli@CalOES; Lee, Doug@CalOES;|_ 

RE: RESPONSE REQUESTED: Information needed for Director's advanced brief 


Hi Tom, 

I am including Dena who is putting together the talking points for the Director, so she can follow-up with you regarding the 
information she needs. 

Thanks much, 

Lori 


From: Ducker, Tom@CalOES 
Sent: Monday, July 11, 2016 7:53 AM 
To: Nezhura, Lori@CalOES 
Cc: Owen, Eli@CalOES; Lee, Doug@CalOES; | 

Subject: RE: RESPONSE REQUESTED: Information needed for Director's advanced brief 


Lori, 


There was no outage from Metcalf. Power was re-routed and additional generation capacity was brought online 
to stabilize the grid. 

The new security guidelines are FERC/NERC CIP-14 standards. 

Those standards set criteria for determining critical stations and required security plans/upgrades at those stations. 

We have already screened the information we received from the California Energy Commission to see what stations are 
likely to fall under CIP-14 and we did an informal review of SoCal Edison's initial threat assessment that will be used for thpir 

CIP-14 review. 

I can get you a summary of CIP-14, if you could use it. 

I also have expanded information on Space Weather, EMP, etc., if you could use that. 

Tom 


From: Owen, Eli@CalOES 

Sent: Monday, July 11, 2016 7:41 AM 

To: Ducker, Tom@CalOES 

Subject: Fwd: RESPONSE REQUESTED: Information needed for Director's advanced brief 
Plz field these . Cc me in response. Tx 


l 
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Eli 


Sent from my iPhone 
Begin forwarded message: 

From: "Wilson, Dena@CalOES" < Dena.Wilson(5>CalOES.ca.eov > 

Date: July 11, 2016 at 7:35:42 AM PDT 

To: "Owen, Eli@CalOES" < Eli.Owen(5)CalOES.ca.eov >. "Nezhura, Lori@CalOES" 
< Lori.Nezhura(5)CalOES.ca.gov > 

Cc: "Lee, Doug@CalOES" < Doug.Lee(5>CalOES.ca.gov >. "Bout, Dan@CalOES" < Dan.Bout(aCalOES.ca.sov > 

Subject: RE: RESPONSE REQUESTED: Information needed for Director's advanced brief 

Thank you Eli. 


I have a couple of questions: 


• The attack on the Metcalf Substation - 

o did it cause an outage? Notes indicated that a major outage was avoided. Was any outage 
experience before power was rerouted? 
o How many homes were effected? 
o How long did the outage last? 

clarify. 

o What were the major revisions to security guidelines? 


Please 


Thanks you in advance, 
Dena 


From: Owen, Eli@CalOES 
Sent: Friday, July 08, 2016 5:52 PM 
To: Nezhura, Lori@CalOES 

Cc: Lee, Doug@CalOES; Wilson, Dena@CalOES; Bout, Dan@CalOES 

Subject: RE: RESPONSE REQUESTED: Information needed for Director's advanced brief 

Draft attached. Will pick this up next week. Thanks. 


From: Nezhura, Lori@CalOES 
Sent: Friday, July 08, 2016 3:55 PM 
To: Owen, Eli@CalOES 

Cc: Lee, Doug@CalOES; Wilson, Dena@CalOES; Bout, Dan@CalOES 

Subject: RE: RESPONSE REQUESTED: Information needed for Director's advanced brief 

Happy Friday! Wondering if we can get what you have so far for the Director's EISS brief? Thanks! 


From: Owen, Eli@CalOES 

Sent: Wednesday, July 06, 2016 4:58 PM 

To: Nezhura, Lori@CalOES; Wilson, Dena@>CalOES; Bout, Dan@CalOES 
Cc: Lee, Doug@CalOES 

Subject: RE: RESPONSE REQUESTED: Information needed for Director's advanced brief 
Copy Thanks. 
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From: Nezhura, Lori@CalOES 

Sent: Wednesday, July 06, 2016 4:51 PM 

To: Owen, Eli@CalOES; Wilson, Dena@CalOES; Bout, Dan@CalOES 

Cc: Lee, Doug@CalOES 

Subject: RE: RESPONSE REQUESTED: Information needed for Director's advanced brief 

Correct. Because of the Director's busy travel schedule in the next two weeks, we need to get the AB to him 
sooner than expected. If this is a hardship for you, we can discuss. 


From: Owen, Eli@CalOES 
Sent: Wednesday, July 06, 2016 4:46 PM 
To: Wilson, Dena@CalOES; Bout, Dan@CalOES 
Cc: Nezhura, Lori@CalOES; Lee, Doug@CalOES 

Subject: RE: RESPONSE REQUESTED: Information needed for Director's advanced brief 
Sorry to be clear - the talk is 7/18 and you are requesting a response by 7/8? 


From: Wilson, Dena@CalOES 
Sent: Wednesday, July 06, 2016 3:46 PM 
To: Owen, Eli@CalOES; Bout, Dan@CalOES 
Cc: Nezhura, Lori@CalOES 

Subject: RESPONSE REQUESTED: Information needed for Director's advanced brief 

Importance: High 

PLEASE RESPOND BY COB, Friday, July 8. 2016 

Eli/Dan, 

The Director is participating in the Electric Infrastructure Security summit in London on July 18 th to discuss 
planning, preparedeness and response/recovery for "Black Sky" (refers to the possibility of continental loss 
of the electrical grid that could be induced by a number of threats like nuclear electromagnetic pulse, cyber¬ 
attacks, severe space weather, etc.) events surrounding Electrical Infrastructure Security and 
cybersecurity. In my discussion with the Director he was looking to cite some examples in California. He 
mentioned specifically the "Metcaf incident (sp?)". Could you provide me a summary of the incident and 
our response plus any other example similar to this? He would like to use a couple of examples for his 
r emarks. - 

I would appreciate it. I have attached the summit agenda for convenience. Please let me know if you have 
any other questions. 

Thank you in advance, 

Dena 

Vena 'Wi.Cson 

Office of Legislative and External Affairs 

California Governor’s Office of Emergency Services 

3650 Schriever Avenue 

Mather, CA 95655 

Office: (916) 845-8940 

www.CalOES.ca.gov 
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Cal OES 

GOVERNOR'S OFFICE 
OF EMERGENCY SERVICES 


4 


PRAJVIuckRock 000015 











Pucker, Tom@CalOES 


From: 

Ducker, Tom@CalOES 

Sent: 

Friday, October 28, 2016 8:47 AM 

To: 

Lyons, Doug@CHP (DLyons@chp.ca.gov) 

Cc: 

Lee, Doug@CalOES; Owen, Eli@CalOES 

Subject: 

FW: sample questions for SCE Full Scale Exercise 


Here is my reply to a request for input on a possible question for next week's SCE round table. 

Came in to my private email from Paul and resent on Cal OES email yesterday. 

From: McGinnis, Paul@CalOES 

Sent: Thursday, October 27, 2016 11:41 AM 

To: Ducker, Tom@CalOES 

Subject: RE: sample questions for SCE Full Scale Exercise 
Hi Tom, 

I believe this response is indeed on target for the discussion that will be had at the SCE exercise roundtable. Thank you 
again for your assistance! 

Best, 


Paul McGinnis 
Legislative Analyst 

CA Governor's Office of Emergency Services 
Office Line: (916) 845-8105 


From: Ducker, Tom@CalOES 

Sent: Thursday, October 27, 2016 11:24 AM 

TQ: Mdginni?, P?ql@C?IQE$_ 

Subject: RE: sample questions for SCE Full Scale Exercise 

Paul, 


Thanks. I take question five as referencing Wildfire impacts as stated in question one, but would suggest the answer 
focus on the regional, interconnect nature of the grid. Standards are set outside of Cal OES (Energy Commission/Public 
Utility Commission at the state or FERC/NERC at a higher level). 

Here is a stab on some of the possible ways the regional nature of the grid could be addressed. 


Question 5: How does this impact the ability to set new standards for infrastructure design? 

First, this is a question that lies within both the California Energy Commission and Public Utility Commissions wheelhouses as 
they set guidelines and standards for private and public energy companies for the state. 


l 
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As standards will need to be, at least, congruent (similar/consistent) across the states within the Region, close attention 
should be paid to standards proposed/adopted through the Federal Energy Regulatory Commission (FERC) and the North 
American Electric Reliability Corporation (NERC). 

An example, in increasing physical security of sub-stations, is the Metcalf incident in California (shooter damaging 
transformers that lead to a shutdown) that sparked a renewed interest in security and the development of NERC's CIP-14. 

More broadly, efforts to simplify and improve the use of response assets cross borders such as through EMAP (with Cal OES 
as an accredited agency) and the encouragement of solutions within the energy industry that improve information sharing 
and pooling of resources would help build upon a resilient design to make for effective and timely response. 


Let me know if this is on target, or if we need something more technical for the Director on design standards. 
Thanks again, 

Tom 


Tom DuckerflHHBlH^B 

Sent: Thursday, October 27, 2016 8:11 AM 
To: Ducker, Tom@CalOES 

Subject: Fw: sample questions for SCE Full Scale Exercise 


On Wednesday, October 26, 2016 10:50 AM, "McGinnis. Paul@CalOES" < Paul.McGinnis@CalOES.ca.aov > wrote: 


Hi all, 

Below are a few questions that I received from SoCal Edison in advance of their full scale exercise taking 
place next week, Nov.2, 2016. I have put the name of the subject matter expert ID’d to best answer the 
questions that Dir. Ghilarducci may be asked during the Senior Leader’s Roundtable discussion. If you 
could provide a brief answer where you see your name at your earliest convenience that would be 


2 


PRA MuckRock 000017 













extremely helpful! If you believe someone else can provide further info or should answer any of the Q's 
please also let me know so I can reach out to them. I have also attached the agenda and exercise 
summary. 

Thanks in advance for your assistance, 


Paul McGinnis 
Legislative Analyst 

CA Governor’s Office of Emergency Services 
Office Line: (916) 845-8105 


From: Daniel Stevens [mailto:Daniel.Stevens@sce.coml 
Sent: Wednesday, October 26, 2016 8:42 AM 
To: McGinnis, Paul@CalOES 
Subject: sample questions 

1 . As evident in SCE’s full scale exercise, severe wild fires can threaten the western interconnection 
[electric grid]. How would you prioritize competing response needs? Don 

2. How does that impact the nuances of the public/private response coordination? Abby 

3. How can emergency managers work with the private sector to prepare for, respond to, and recover 
from climate-related incidents? Abby 

4. How will increasingly common and severe events impact emergency and risk management 
strategies? Tina 

5. How does this impact the ability to set new standards for infrastructure design? Tom 

6. How will state and local resource planning efforts for responding to and leading recovery efforts 
evolve with increased frequency and severity of climate related events? Tina 

7. How will risk reduction programs inform planning efforts? Tina 

Thanks, 

Daniel Stevens, CEM 

Training & Exercise Program Manager 

Southern California Edison - Business Resiliency 

Dai liel.Slevei is@bc(jxum -—-- 



Paul- 

Attached is the agenda for our external agency observers, which also includes a high level overview of 
the objectives. There are several areas we would like Mark to participate in during the day, which are 
very similar to his engagement last year during our Full Scale. Please let me know if you have additional 
questions. 
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1. Inject delivery. Our company executives will be engaged in exercise play from about 8am until 
10:30. We have 1 inject we would like Mark to call into the exercise, he just had to read from the script, 
which I included here: 



9:05 AM 


Cal OES Director 
Mark Ghilarducci 


CMC 


Good Morning, this is Mark Ghilarducci. Director of Cal OES. I wa 
we are coordinating at all possible levels during this incident, partic 
across Southern California. 1 have asked my staff to coordinate wit! 
necessary. Are there any immediate resource needs or other asks of 


2. Mock-Press Brief. Our CEO will be asked to give a press brief at 10:30 as part of the exercise. 
The purpose of the brief is to update the media/public on power outages and SCEs response to multiple 
wildfires impacting our infrastructure. Realistically it would be the county or a state press brief and not 
necessarily initiated by SCE. Similar to last year, we would like Mark to kick off the press-brief, 
essentially saying, we have called for this press brief so that SCE can provide an update on the outages. 
Mark will have a script (currently being developed) that he can read from, its just to kick off that part of 
the exercise. No real media will be present. 

3. Roundtable. There will be about 23 external participants in a senior-level roundtable to discuss 
climate change and impacts to critical infrastructure. See participants below. Here are the objectives of 
the roundtable: 

a. Identify lines of responsibility for federal, state, local, and industry partners in mitigating and 
managing the effects of climate change on the national grid 

b. Explore key attributes of federal, state, local, and industry partners and identify potential 
opportunities for multi-partner response and resiliency planning 

c. Assess future state of climate resilience policy with respect to the electric utility industry 

d. Examine public and private approaches for identifying and overcoming financial and resource 
challenges related to mitigating and responding to multiple or simultaneous climate-related incidents 
impacting energy infrastructure 
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TBD 

FEMA 


Ken Bueil 
DOE 


Greg Grillo 
NREC 


Jeffrey Vail 
Forest Service 


Bill Patzert 
NASA JPl 


Back of the Room 




Nitin Natarajan 
EPA 


Christy Riccardi 
DHS. Office of 


Screen 


First Row Reserved for SMEs 


RO Nichols 
SCE 

President 


Kevin Payne 
SCE CEO 


Adam 
Umanoff 
Chief Counsel 



Ellen 
Tauscher 
Board Member 


Mark Ghilarducci 
Cal OES 


John Sowers 
SDG&E 


Ed DeVarona 
FPL 


Chris Eisenbrey 
EEI 


lan Kline 
CEO Cadmus 


Joe Tyler 
CAL Fire 


Jeff Reeb 
LA County EM 


Placeholder Chair 


Screen 


Thanks, 

Daniel Stevens, CEM 

Tra i ning & Exerc i se Program Manager 

Southern California Edison - Business Resiliency 

Daniel.Stevens@sce.com 

626-302-6857 (o) / PAX 26857 

From: McGinnis, Paul@CalOES [mailto:Paul.McGinnis@CalOES.ca.gov] 

Sent: Monday, October 24, 2016 2:03 PM 
To: Daniel Stevens < Daniel.Stevens@sce.com > 

Subject: (Extemal):SCE Full Scale Exercise Brief 

Hi Daniel, 

I am preparing an advanced brief for Cal OES Director Mark Ghilarducci with regards to the So Cal 
Edison Full Scale Exercise coming up on Wed. Nov 2. I have been notified he will be participating in 
both the mock press brief as well as the executive roundtable. I just had a few questions regarding the 
event that will assist me in drafting a brief for the Director 
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1. Will the Director be speaking at either the roundtable or the press brief, and if so are there any 
talking points to be made available? 

2. Is there an agenda of events for the exercise? 

3. Do you have an attendee list that you can share? 

4. Any other information about the event that may be beneficial for Director Ghilarducci would be 
much appreciated 

Thanks so much in advance of your review, and I look forward to hearing from you, 

Best, 


Paul McGinnis 
Legislative Analyst 

CA Governor’s Office of Emergency Services 
Office Line: (916)845-8105 
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Ducker, Tom@CalOES 


From: 

Sent: 

To: 

Cc: 

Subject: 


Owen, Eli@CalOES 

Wednesday, February 14, 2018 11:41 AM 
Ducker, Tom@CalOES; Michael@CHP McCarthy 


Tresh, Keith@CalOES 


RE: MetCalf Incident 2013 


This was very helpful - 1 called the WY HSA, on behalf of MG, and briefed the below. Thank you sir. 


|; Tresh, Keith@)CalOES 
Eli, 

It looks like this is a legislative related review. I'll get you a more detailed update by Friday. Bottom line is that federal 
regulation changed to increase security at sub-stations, our California legislature mandated a review of existing California 
regulation with a view to extending increased security to the distribution side of the grids, and utilities took additional 
security measures. 

Tom 

Tom Ducker, CPP 

Team Lead/IP Gateway Administrator/PCII Officer 
Critical Infrastructure Protection (CIP) Unit 
State Threat Assessment Center (STAC) 

California Governor's Office of Emergency Services 
tom.ducker(a)caloes.ca.Kov 

916-636-2917 (Desk) 

^HH(Cell) 

Certified Protection Professional (CPP*) - This certification designates individuals who have demonstrated competency in all 

areas constituting security management 

This communication, along with any attachments, is covered by federal and state law governing electronic communications 
and may contain confidential and legally privileged information. If the reader of this message is not the intended recipient, 
you are hereby notified that any dissemination, distribution, use or copying of this message is strictly prohibited. If you have 
received this in error, please reply immediately to the sender and delete this message. Thank you. 


From: Ducker, Tom@CalOES 

Sent: Wednesday, February 14, 2018 7:01 AM 

To: Owen, Eli@CalOES; Michael@CHP McCarthy 

cciBHHIHHHH' I 

Subject: RE: MetCalf Incident 2013 


From: Owen, Eli@CalOES 

Sent: Tuesday, February 13, 2018 9:28 PM 

To: Ducker, Tom@CalOES; Michael@CHP McCarthy 

Cc: H 

Subject: Fwd: MetCalf Incident 2013 


; Tresh, Keith@CalOES 


Fysa let me know if there is an update 
By Friday if possible. 
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Sent from my iPhone 
Begin forwarded message: 


From: "Ghilarducci, Mark@CalOES" < Mark.Ghilarducci@CalOES.ca.gov > 
Date: February 13, 2018 at 9:21:09 PM PST 

To: "Owen, Eli@CalOES" < Eli.Owen@.CalOES.ca.gov >. "Pal, Alex@CalOES" 
< Alex.Pal@CalOES.ca.gov > 

Cc: "Pazin, Mark@CalOES" < Mark.Pazin@,CalOES.ca.gov > 

Subject: Fvvd: MetCalf Incident 2013 


Eli, Alex, Mark 

Please see email from Director Cameron in WYOMING. Is there an answer to his question? 
M. 

Begin forwarded message: 

From: Guy Cameron < guy.cameron@wvo.gov > 

Date: Febmary 7, 2018 at 10:54:47 AM PST 

To: "Ghilarducci, Mark@CalOES" < Mark.Ghilarducci@,caloes.ca.gov > 

Subject: MetCalf Incident 2013 

Good morning Mark, 

I hope all is well. I wanted to ask if there has been any update on the MetCalf incident 
that occurred a few years back. 

Mark, Wyoming's legislative session is kicking off next week and "Trespass 
Penalties" are being increased for those knowingly trespassing on Critical 
Infrastructure properties outlined in the bill. I understand there was an attempt to 
pass this legislation in Oklahoma this past year. 

- Thinking buck to tills aillfomlu incident, thought it might bb helpful to see if there - 

were any action items that came of this event. 

Thanks 

Respectfully, 

Guy 


Guy Cameron 
Director 

Wyoming Office of Homeland Security 
guv.cameron@wvo.gov 
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(307) 777-85H 


E-Mail to and from me, in connection with the transaction 
of public business, is subject to the Wyoming Public Records 
Act and may be disclosed to third parties. 
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